A few years ago, during a particularly spam heavy period, I got pissed at Google's ineptness at combating spam, and decided to have a think about how I could get rid of the problem for good.
What I arrived at:
- I should never hand out my actual email address. As in, should be all proxied, every contact reaching me via a different address only known to them. Ideally, these aliases would be generated using a CSPRNG, and would be of sufficient length. Allows for tracing contact provenance in "space".
- I should rotate that address periodically, if possible. Allows for tracing contact provenance in "time".
Together, this would tell me who's the source of any particular influx of strange mails, and when did they leak the contact address provided to them (willfully or otherwise). This would enable me to separate the wheat from the chaff and nuke that address for good, inform the other party, etc.
I was really taken by this idea, even wondered why this has not been baked into the underlying protocols over the years, to make it readily deployed and available for all, making it effortless.
Because boy is there an effort involved! Several years later, I now avoid spam mail by simply no longer reading my emails anymore...
Sometimes I wonder what corporate IT thinks when I pass their anti-phishing test a month after the test campaign.
I estimate that I can identify 99.5% of spam by the subject line alone. I don't know why its such a hard problem, and why renewal notices for Norton 360 Premium sent to "Customer" from a random gmail address keep passing as legitimate email.
Hell, just block all emails mentioning Norton 360. Wouldn't be any great loss to the world.
But what I don't understand is MS letting these through the spam filter but randomly, in a thread between myself and another person both using MS account emails, sending a single email in that thread to spam.
One thing to be careful of is email hosts that dump your account after x months of inactivity. Logging in once in a while is good, got burned by this once.
Comments
A few years ago, during a particularly spam heavy period, I got pissed at Google's ineptness at combating spam, and decided to have a think about how I could get rid of the problem for good.
What I arrived at:
- I should never hand out my actual email address. As in, should be all proxied, every contact reaching me via a different address only known to them. Ideally, these aliases would be generated using a CSPRNG, and would be of sufficient length. Allows for tracing contact provenance in "space".
- I should rotate that address periodically, if possible. Allows for tracing contact provenance in "time".
Together, this would tell me who's the source of any particular influx of strange mails, and when did they leak the contact address provided to them (willfully or otherwise). This would enable me to separate the wheat from the chaff and nuke that address for good, inform the other party, etc.
I was really taken by this idea, even wondered why this has not been baked into the underlying protocols over the years, to make it readily deployed and available for all, making it effortless.
Because boy is there an effort involved! Several years later, I now avoid spam mail by simply no longer reading my emails anymore...
Sometimes I wonder what corporate IT thinks when I pass their anti-phishing test a month after the test campaign.
I estimate that I can identify 99.5% of spam by the subject line alone. I don't know why its such a hard problem, and why renewal notices for Norton 360 Premium sent to "Customer" from a random gmail address keep passing as legitimate email.
Hell, just block all emails mentioning Norton 360. Wouldn't be any great loss to the world.
But what I don't understand is MS letting these through the spam filter but randomly, in a thread between myself and another person both using MS account emails, sending a single email in that thread to spam.
I realized the other day I haven't even checked my main email in months and I missed absolutely noting important.
One thing to be careful of is email hosts that dump your account after x months of inactivity. Logging in once in a while is good, got burned by this once.
Except the H
Check out spamgourmet; they came up with roughly the same thing over 25 years ago, and implemented it, and handed it out to all for free. ;)